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Period for Reply 



A SHORTENED STATUTORY PERIOD FOR REPLY IS SET TO EXPIRE 3 MONTH(S) OR THIRTY (30) DAYS, 
WHICHEVER IS LONGER, FROM THE MAILING DATE OF THIS COMMUNICATION. 

- Extensions of time may be available under the provisions of 37 CFR 1 .136(a). In no event, however, may a reply be timely filed 
after SIX (6) MONTHS from the mailing date of this communication. 

- If NO period for reply is specified above, the maximum statutory period will apply and will expire SIX (6) MONTHS from the mailing date of this communication. 

- Failure to reply within the set or extended period for reply will, by statute, cause the application to become ABANDONED (35 U.S.C. § 133). 
Any reply received by the Office later than three months after the mailing date of this communication, even if timely filed, may reduce any 
earned patent term adjustment. See 37 CFR 1 .704(b). 

Status 

1 )^| Responsive to communication(s) filed on 05 February 2009 . 
2a )£3 This action is FINAL. 2b)^ This action is non-final. 

3) D Since this application is in condition for allowance except for formal matters, prosecution as to the merits is 

closed in accordance with the practice under Ex parte Quayle, 1935 CD. 11, 453 O.G. 213. 

Disposition of Claims 

4) ^3 Claim(s) 1-20 is/are pending in the application. 

4a) Of the above claim(s) is/are withdrawn from consideration. 

5) D Claim(s) is/are allowed. 

6) |EI Claim(s) 1-20 is/are rejected. 

7) D Claim(s) is/are objected to. 

8) D Claim(s) are subject to restriction and/or election requirement. 

Application Papers 

9) L~H The specification is objected to by the Examiner. 

10)D The drawing(s) filed on is/are: a)^ accepted or b)^ objected to by the Examiner. 

Applicant may not request that any objection to the drawing(s) be held in abeyance. See 37 CFR 1.85(a). 
Replacement drawing sheet(s) including the correction is required if the drawing(s) is objected to. See 37 CFR 1.121(d). 
The oath or declaration is objected to by the Examiner. Note the attached Office Action or form PTO-152. 

Priority under 35 U.S.C. § 119 
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a)D All b)D Some * c)D None of: 

1 0 Certified copies of the priority documents have been received. 

20 Certified copies of the priority documents have been received in Application No. . 

3.Q Copies of the certified copies of the priority documents have been received in this National Stage 
application from the International Bureau (PCT Rule 17.2(a)). 
* See the attached detailed Office action for a list of the certified copies not received. 
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DETAILED ACTION 



Acknowledgements 



1. 



This action is in reply to the Reply filed on February 5, 2009. 



2. 



Claims 1-15 have been amended. 



3. 



Claims 16-20 have been added. 



4. 



Claims 1-20 are currently pending and have been examined. 



Claim Rejections - 35 USC § 101 



5. 



In light of Applicant's amendments, the former rejection is withdrawn. 



Claim Rejections - 35 USC § 112, 2 nd paragraph 



6. The following is a quotation of the second paragraph of 35 U.S.C. 112: 

The specification shall conclude with one or more claims particularly pointing out and distinctly 
claiming the subject matter which the applicant regards as his invention. 

7. Claims 4, 9, and 14 are rejected under 35 U.S.C. 112, second paragraph, as being indefinite for 
failing to particularly point out and distinctly claim the subject matter which applicant regards as the 
invention. 

8. Claims 4, 9, and 14 state "identify unnecessary exchanges of data, for possible elimination." This 
language is vague and indefinite because 1) "unnecessary" is subjective in meaning; and 2) the data is 
eliminated, or is not eliminated. For prior art purposes, Examiner will assume "identify exchanges of data 
for elimination." 



9. The following is a quotation of 35 U.S.C. 103(a) which forms the basis for all obviousness 

rejections set forth in this Office action: 

A patent may not be obtained though the invention is not identically disclosed or described as set 
forth in section 102 of this title, if the differences between the subject matter sought to be 
patented and the prior art are such that the subject matter as a whole would have been obvious 
at the time the invention was made to a person having ordinary skill in the art to which said 



Claim Rejections - 35 USC § 103 
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subject matter pertains. Patentability shall not be negatived by the manner in which the invention 
was made. 

10. Claims 1-20 are rejected under 35 U.S.C. 103(a) as being unpatentable over Coffey et al. (US 
6,636,858) in view of Ginter et al. (US 5,892,900). 

Claims 1,6, 11 

1 1 . Coffey discloses the following limitations: 

a. generate an object model (relationship license) for representing relationships between 
active entities with regard to handling of personally identifiable information, wherein the active 
entities comprise a data subject (first entity), represented as a data subject object (first entity 
license number) in the object model, and at least one data user (second entity), represented as at 
least one data user object (second entity license number) in the object model, and wherein the 
data subject is an active entity that is identified by the personally identifiable information (attribute 
license) and the at least one data user is an active entity that uses the personally identifiable 
information obtained from the data subject (C2 L45 - C3 L67); 

b. identify parties (two or more entities) involved in a process of handling personally 
identifiable information based on the object model, wherein the parties comprise the data subject 
and the at least one data user (C2 L45 - C3 L67); 

c. identify data (entity license numbers) involved in said process from a data model (C2 L45 
- C3 L67); 

d. classify the data as personally identifiable information (name: Mary Smith) or non- 
personally identifiable information (medication Plaseebo) (C9 L47 - C10 L15); 

e. express, based on the object model (relationship license), each relationship between 
each pair of said parties (entities) in terms of a privacy agreement (relationship attribute license), 
wherein the privacy agreement for each relationship between each pair of parties is a subset of a 
natural language privacy policy set, the subset being defined as specific to a particular situation 
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(designate mother status) or purpose and specific to the particular parties in the pair of parties 
(C6 L47-C7L17); 

f. represent said parties (entities), said data (entity license numbers), and said privacy 
agreements (relationship attribute license) graphically as objects and associations between 
objects in one or more privacy agreement relationship diagrams (relationship diagram), wherein 
(figures 5 and 7-8, C7 L44 - C8 L10). 

12. Coffey does not disclose the following limitations: 

g. A processor; 

h. A memory. . . processor to; 

i. Each privacy agreement... information; 
j. Said privacy agreement... associated. 

13. Ginter discloses the following limitations: 

k. a processor (processors) (C1 L31-37, C20 L44-67); 

I. a memory (memory) coupled to the processor, wherein the memory comprises 
instructions which, when executed by the processor, cause the processor to (C18 L6-21); 
m. each privacy agreement uses a limited number (thresholds, quantity limits) of privacy- 
related actions concerning said personally identifiable information (C330 L8-45); 
n. said privacy agreement expresses privacy rules (rules and controls) regarding said 
privacy-related actions, for each party in a pair of parties with which the privacy agreement is 
associated (C57 L45-55). 

14. It would have been obvious to one of ordinary skill in the art at the time of the invention to 
combine Coffey with Ginter because 1) a need exists in the art of computer implemented database 
design, generation, and use to provide a method to flexibly create relatedness among stored data 
elements in relationship patterns that are often of unforeseeable or unpredictable significance, nature or 
value at the time of entry of some data values (Coffey C1 L17-47); and 2) a need exists to ensure that 
information is assessed in authorized ways, and that confidentiality of said information and privacy rights 
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are maintained (Ginter C1 L5-37, C4 L5 - C5 L40). Using a privacy agreement will help to ensure 
authorized access and privacy rights. 

Claims 2, 7, 12 

15. Coffey, in view of Ginter, discloses the limitations above. Furthermore, Ginter discloses the 
following limitations: 

o. map a business process (event) to privacy rules of one or more privacy agreements for 
each pair of parties (C196 L45-C197 L5). 

16. It would have been obvious to one of ordinary skill in the art at the time of the invention to 
combine Coffey with Ginter because 1) a need exists in the art of computer implemented database 
design, generation, and use to provide a method to flexibly create relatedness among stored data 
elements in relationship patterns that are often of unforeseeable or unpredictable significance, nature or 
value at the time of entry of some data values (Coffey C1 L17-47); and 2) a need exists to ensure that 
information is assessed in authorized ways, and that confidentiality of said information and privacy rights 
are maintained (Ginter C1 L5-37, C4 L5 - C5 L40). Mapping a business process will help to ensure 
authorized access and privacy rights. 

Claims 3, 8, 13 

17. Coffey, in view of Ginter, discloses the limitations above. Furthermore, Ginter discloses the 
following limitations: 

p. identify opportunities to reduce privacy-related risks (usage information may be filtered) 
involved in said process based on the one or more privacy agreement relationship diagrams 
(C279 L50-61, C318 L59 - C319 L14). 

18. It would have been obvious to one of ordinary skill in the art at the time of the invention to 
combine Coffey with Ginter because 1) a need exists in the art of computer implemented database 
design, generation, and use to provide a method to flexibly create relatedness among stored data 
elements in relationship patterns that are often of unforeseeable or unpredictable significance, nature or 
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value at the time of entry of some data values (Coffey C1 L17-47); and 2) a need exists to ensure that 
information is assessed in authorized ways, and that confidentiality of said information and privacy rights 
are maintained (Ginter C1 L5-37, C4 L5 - C5 L40). Identifying opportunities to reduce privacy-related 
risks will help to ensure authorized access and privacy rights. 

Claims 4, 9, 14 

19. Coffey, in view of Ginter, discloses the limitations above. Furthermore, Ginter discloses the 
following limitations: 

q. identify unnecessary exchanges of data (use of specific titles), for possible elimination 
based on the one or more privacy agreement relationship diagrams (C279 L50-61, C318 L59 - 
C319 L14). 

20. It would have been obvious to one of ordinary skill in the art at the time of the invention to 
combine Coffey with Ginter because 1) a need exists in the art of computer implemented database 
design, generation, and use to provide a method to flexibly create relatedness among stored data 
elements in relationship patterns that are often of unforeseeable or unpredictable significance, nature or 
value at the time of entry of some data values (Coffey C1 L17-47); and 2) a need exists to ensure that 
information is assessed in authorized ways, and that confidentiality of said information and privacy rights 
are maintained (Ginter C1 L5-37, C4 L5 - C5 L40). Identifying unnecessary exchanges of data will help 
to ensure authorized access and privacy rights. 

Claims 5, 10, 15 

21. Coffey, in view of Ginter, discloses the limitations above. Furthermore, Ginter discloses the 
following limitations: 

r. identify opportunities to transform data into a less sensitive form based on the one or 
more privacy agreement relationship diagrams, wherein the less sensitive form is one of a de- 
personalized form (reveal only certain information) or an anonymous form (reported 
anonymously) (C57 L45-55, C279 L50-61, C318 L59 - C319 L14). 
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22. It would have been obvious to one of ordinary skill in the art at the time of the invention to 
combine Coffey with Ginter because 1) a need exists in the art of computer implemented database 
design, generation, and use to provide a method to flexibly create relatedness among stored data 
elements in relationship patterns that are often of unforeseeable or unpredictable significance, nature or 
value at the time of entry of some data values (Coffey C1 L17-47); and 2) a need exists to ensure that 
information is assessed in authorized ways, and that confidentiality of said information and privacy rights 
are maintained (Ginter C1 L5-37, C4 L5 - C5 L40). Identifying opportunities to transform data into a less 
sensitive form will help to ensure authorized access and privacy rights. 

Claims 16, 18 

23. Coffey, in view of Ginter, discloses the limitations above. Furthermore, Ginter discloses the 
following limitations: 

s. the less sensitive form is a de-personalized form (reveal only certain information) in which 
transformed data does not contain personally identifiable information that identifies the data 
subject but is able to be associated with the data subject using other data (information derived 
from usage) having personally identifiable information (C57 L45-55). 

24. It would have been obvious to one of ordinary skill in the art at the time of the invention to 
combine Coffey with Ginter because 1) a need exists in the art of computer implemented database 
design, generation, and use to provide a method to flexibly create relatedness among stored data 
elements in relationship patterns that are often of unforeseeable or unpredictable significance, nature or 
value at the time of entry of some data values (Coffey C1 L17-47); and 2) a need exists to ensure that 
information is assessed in authorized ways, and that confidentiality of said information and privacy rights 
are maintained (Ginter C1 L5-37, C4 L5 - C5 L40). Using a de-personalized form will help to ensure 
authorized access and privacy rights. 



Claims 17, 19 
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25. Coffey, in view of Ginter, discloses the limitations above. Furthermore, Ginter discloses the 
following limitations: 

t. the less sensitive form is an anonymous form (reported anonymously) in which 
transformed data does not contain personally identifiable information that identifiers the data 
subject and is not able to be associated with the data subject (C57 L45-55). 

26. It would have been obvious to one of ordinary skill in the art at the time of the invention to 
combine Coffey with Ginter because 1) a need exists in the art of computer implemented database 
design, generation, and use to provide a method to flexibly create relatedness among stored data 
elements in relationship patterns that are often of unforeseeable or unpredictable significance, nature or 
value at the time of entry of some data values (Coffey C1 L17-47); and 2) a need exists to ensure that 
information is assessed in authorized ways, and that confidentiality of said information and privacy rights 
are maintained (Ginter C1 L5-37, C4 L5 - C5 L40). Using an anonymous form will help to ensure 
authorized access and privacy rights. 

Claim 20 

27. Please see claims 16-17. 

28. Examiner's Note: The Examiner has pointed out particular references contained in the prior art 
of record within the body of this action for the convenience of the Applicant. Although the specified 
citations are representative of the teachings in the art and are applied to the specific limitations within the 
individual claim, other passages and figures may apply. Applicant, in preparing the response, should 
consider fully the entire reference as potentially teaching all or part of the claimed invention, as well as 
the context of the passage as taught by the prior art or disclosed by the Examiner. 

Response to Arguments 

29. Applicant argues that King, Kroenke, and Spies do not disclose all the limitations above 
(amendment p 10-18). This argument is moot in light of the new art references above. 
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Conclusion 

30. Applicant's amendment filed on February 5, 2009 necessitated the new grounds of rejection 
presented in this Office action. Accordingly, THIS ACTION IS MADE FINAL. See MPEP § 706.07(a). 
Applicant is reminded of the extension of time policy as set forth in 37 CFR 1 . 1 36(a). 

31. A shortened statutory period for reply to this final action is set to expire THREE MONTHS from 
the mailing date of this action. In the event a first reply is filed within TWO MONTHS of the mailing date of 
this final action and the advisory action is not mailed until after the end of the THREE-MONTH shortened 
statutory period, then the shortened statutory period will expire on the date the advisory action is mailed, 
and any extension fee pursuant to 37 CFR 1.136(a) will be calculated from the mailing date of the 
advisory action. In no event, however, will the statutory period for reply expire later than SIX MONTHS 
from the date of this final action. 

32. Any inquiry of a general nature or relating to the status of this application or concerning this 
communication or earlier communications from the Examiner should be directed to Chrystina 
Zelaskiewicz whose telephone number is 571.270.3940. The Examiner can normally be reached on 
Monday-Friday, 9:30am-5:00pm. If attempts to reach the examiner by telephone are unsuccessful, the 
Examiner's supervisor, Andrew Fischer can be reached at 571.272.6779. 

33. Information regarding the status of an application may be obtained from the Patent Application 
Information Retrieval (PAIR) system. Status information for published applications may be obtained from 
either Private PAIR or Public PAIR. Status information for unpublished applications is available through 
Private PAIR only. For more information about the PAIR system, see 
http://portal.uspto.gov/external/portal/pair <http://pair-direct.uspto.gov>. Should you have questions on 
access to the Private PAIR system, contact the Electronic Business Center (EBC) at 866.217.9197 (toll- 
free). 

/Chrystina Zelaskiewicz/ 
Examiner, Art Unit 3621 
February 24, 2009 

/ANDREW J. FISCHER/ 

Supervisory Patent Examiner, Art Unit 3621 



